cnvd - cnvd-2020-14080

CNVD-2020-14080

Vulnerability from cnvd - Published: 2020-02-27

Title

XnView RGB文件处理缓冲区溢出漏洞

Description

XnView是法国软件开发者Gougelet Pierre-Emmanuel所研发的一套多平台图片查看软件。该软件可用于查看、转换、组织和编辑图形及视频文件。 XnView中存在远程缓冲区溢出漏洞，该漏洞源于程序未正确对用户提供的输入进行边界检查，导致程序复制数据的大小超出了分配的内存缓冲区空间。攻击者可利用该漏洞在应用程序上下文中执行任意代码，也可能造成拒绝服务。XnView 2.04版本中存在漏洞，其他版本也可能受到影响。

Severity

高

Patch Name

XnView RGB文件处理缓冲区溢出漏洞的补丁

Patch Description

Formal description

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： http://newsgroup.xnview.com/viewtopic.php?f=35&t=29087

Reference

http://www.securityfocus.com/bid/64441

Impacted products

Name
Xnview XnView 2.04

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "64441"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2013-3939",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2013-3939"
    }
  },
  "description": "XnView\u662f\u6cd5\u56fd\u8f6f\u4ef6\u5f00\u53d1\u8005Gougelet Pierre-Emmanuel\u6240\u7814\u53d1\u7684\u4e00\u5957\u591a\u5e73\u53f0\u56fe\u7247\u67e5\u770b\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u53ef\u7528\u4e8e\u67e5\u770b\u3001\u8f6c\u6362\u3001\u7ec4\u7ec7\u548c\u7f16\u8f91\u56fe\u5f62\u53ca\u89c6\u9891\u6587\u4ef6\u3002\n\nXnView\u4e2d\u5b58\u5728\u8fdc\u7a0b\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u6b63\u786e\u5bf9\u7528\u6237\u63d0\u4f9b\u7684\u8f93\u5165\u8fdb\u884c\u8fb9\u754c\u68c0\u67e5\uff0c\u5bfc\u81f4\u7a0b\u5e8f\u590d\u5236\u6570\u636e\u7684\u5927\u5c0f\u8d85\u51fa\u4e86\u5206\u914d\u7684\u5185\u5b58\u7f13\u51b2\u533a\u7a7a\u95f4\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u5e94\u7528\u7a0b\u5e8f\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4efb\u610f\u4ee3\u7801\uff0c\u4e5f\u53ef\u80fd\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002XnView 2.04\u7248\u672c\u4e2d\u5b58\u5728\u6f0f\u6d1e\uff0c\u5176\u4ed6\u7248\u672c\u4e5f\u53ef\u80fd\u53d7\u5230\u5f71\u54cd\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttp://newsgroup.xnview.com/viewtopic.php?f=35\u0026t=29087",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-14080",
  "openTime": "2020-02-27",
  "patchDescription": "XnView\u662f\u6cd5\u56fd\u8f6f\u4ef6\u5f00\u53d1\u8005Gougelet Pierre-Emmanuel\u6240\u7814\u53d1\u7684\u4e00\u5957\u591a\u5e73\u53f0\u56fe\u7247\u67e5\u770b\u8f6f\u4ef6\u3002\u8be5\u8f6f\u4ef6\u53ef\u7528\u4e8e\u67e5\u770b\u3001\u8f6c\u6362\u3001\u7ec4\u7ec7\u548c\u7f16\u8f91\u56fe\u5f62\u53ca\u89c6\u9891\u6587\u4ef6\u3002\r\n\r\nXnView\u4e2d\u5b58\u5728\u8fdc\u7a0b\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u6b63\u786e\u5bf9\u7528\u6237\u63d0\u4f9b\u7684\u8f93\u5165\u8fdb\u884c\u8fb9\u754c\u68c0\u67e5\uff0c\u5bfc\u81f4\u7a0b\u5e8f\u590d\u5236\u6570\u636e\u7684\u5927\u5c0f\u8d85\u51fa\u4e86\u5206\u914d\u7684\u5185\u5b58\u7f13\u51b2\u533a\u7a7a\u95f4\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u5e94\u7528\u7a0b\u5e8f\u4e0a\u4e0b\u6587\u4e2d\u6267\u884c\u4efb\u610f\u4ee3\u7801\uff0c\u4e5f\u53ef\u80fd\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002XnView 2.04\u7248\u672c\u4e2d\u5b58\u5728\u6f0f\u6d1e\uff0c\u5176\u4ed6\u7248\u672c\u4e5f\u53ef\u80fd\u53d7\u5230\u5f71\u54cd\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "XnView RGB\u6587\u4ef6\u5904\u7406\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Xnview XnView 2.04"
  },
  "referenceLink": "http://www.securityfocus.com/bid/64441",
  "serverity": "\u9ad8",
  "submitTime": "2020-01-07",
  "title": "XnView RGB\u6587\u4ef6\u5904\u7406\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e"
}

CVE-2013-3939 (GCVE-0-2013-3939)

Vulnerability from cvelistv5 – Published: 2020-01-02 19:11 – Updated: 2024-08-06 16:30

Summary

xnview.exe in XnView before 2.13 does not properly handle RLE strip lengths during processing of RGB files, which allows remote attackers to execute arbitrary code via the RLE strip size field in a RGB file, which leads to an unexpected sign extension error and a heap-based buffer overflow.

Severity ?

No CVSS data available.

CWE

Other

Assigner

flexera

References

URL

Tags

	http://secunia.com/advisories/52101	third-party-advisoryx_refsource_SECUNIA
	http://newsgroup.xnview.com/viewtopic.php?f=35&t=29087	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	XnView	XnView	Affected: before 2.13

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T16:30:48.182Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "52101",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/52101"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://newsgroup.xnview.com/viewtopic.php?f=35\u0026t=29087"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "XnView",
          "vendor": "XnView",
          "versions": [
            {
              "status": "affected",
              "version": "before 2.13"
            }
          ]
        }
      ],
      "datePublic": "2013-12-19T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "xnview.exe in XnView before 2.13 does not properly handle RLE strip lengths during processing of RGB files, which allows remote attackers to execute arbitrary code via the RLE strip size field in a RGB file, which leads to an unexpected sign extension error and a heap-based buffer overflow."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Other",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-01-02T19:11:43",
        "orgId": "44d08088-2bea-4760-83a6-1e9be26b15ab",
        "shortName": "flexera"
      },
      "references": [
        {
          "name": "52101",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/52101"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://newsgroup.xnview.com/viewtopic.php?f=35\u0026t=29087"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "PSIRT-CNA@flexerasoftware.com",
          "ID": "CVE-2013-3939",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "XnView",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 2.13"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "XnView"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "xnview.exe in XnView before 2.13 does not properly handle RLE strip lengths during processing of RGB files, which allows remote attackers to execute arbitrary code via the RLE strip size field in a RGB file, which leads to an unexpected sign extension error and a heap-based buffer overflow."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Other"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "52101",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/52101"
            },
            {
              "name": "http://newsgroup.xnview.com/viewtopic.php?f=35\u0026t=29087",
              "refsource": "CONFIRM",
              "url": "http://newsgroup.xnview.com/viewtopic.php?f=35\u0026t=29087"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "44d08088-2bea-4760-83a6-1e9be26b15ab",
    "assignerShortName": "flexera",
    "cveId": "CVE-2013-3939",
    "datePublished": "2020-01-02T19:11:43",
    "dateReserved": "2013-06-04T00:00:00",
    "dateUpdated": "2024-08-06T16:30:48.182Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2020-14080

CVE-2013-3939 (GCVE-0-2013-3939)

Tags

Sightings

Nomenclature